0361c12c07
The edition package lists installed BOTH grub-pc and grub-efi-amd64 (+ shim-signed). Those provide the same bootloader role and conflict in apt, so every rootfs build failed with "unable to correct problems, you have held broken packages". A rootfs now carries exactly ONE bootloader, chosen by the BOOT variable (mirroring the existing --boot bios|efi deploy option): - versions.mk / common.sh: BOOT := bios (bios -> grub-pc, efi -> grub-efi-amd64 + shim-signed + mokutil), exported via the Makefile. - build-rootfs.sh validates BOOT early and injects the matching boot packages into the apt install; the static package lists no longer contain any grub package. - deploy-disk.sh / build-image.sh / install.sh default --boot from the same BOOT variable, so a rootfs and the artifact deployed from it can never disagree (BOOT=efi make image-cloud produces a UEFI image). - mokutil is now installed explicitly in the efi flavour (it was not pulled in because we install with --no-install-recommends). - docs updated (building.md knob + rationale, secureboot.md note).
63 lines
2.3 KiB
Markdown
63 lines
2.3 KiB
Markdown
# Secure boot (MOK-based)
|
|
|
|
Arcline can ship **self-signed** boot chains verified by your machine's own
|
|
secure-boot firmware. We use a **Machine Owner Key (MOK)** — the same approach
|
|
used to load custom kernels on Windows-certified laptops — rather than paying
|
|
for a Microsoft KEK signing cert. You own the key, you own the trust anchor.
|
|
|
|
```
|
|
MOK.priv ──(sbsign)──► vmlinuz, grubx64.efi, shimx64.efi
|
|
MOK.der ──(mokutil)──► enrolled into firmware MOK list (one-time prompt)
|
|
```
|
|
|
|
## Workflow
|
|
|
|
1. **Generate the key** (once, keep it secret):
|
|
|
|
```bash
|
|
scripts/secureboot/gen-keys.sh # → build/keys/{MOK.priv,MOK.pem,MOK.der}
|
|
```
|
|
|
|
2. **Build a signed image** (ISO or disk image):
|
|
|
|
```bash
|
|
ARCLINE_SIGN=1 make iso-server
|
|
ARCLINE_SIGN=1 make image-cloud
|
|
```
|
|
|
|
The build signs every kernel + EFI binary in the boot chain with the MOK
|
|
and ships the *public* `MOK.der` into the image at `/etc/arcline/MOK.der`.
|
|
|
|
3. **Enroll on first boot** — the `arcline-mok-enroll.service` unit imports the
|
|
key automatically the first time the system boots with secure boot enabled.
|
|
The firmware shows a one-time "Enroll MOK" prompt; confirm it, reboot, done.
|
|
The unit disables itself afterwards (and no-ops entirely when no key was
|
|
shipped — secure boot is off by default).
|
|
|
|
Manual alternative:
|
|
|
|
```bash
|
|
sudo mokutil --import /etc/arcline/MOK.der
|
|
sudo reboot # then confirm at the blue MOK manager screen
|
|
```
|
|
|
|
## What gets signed
|
|
|
|
- kernels (`vmlinuz*`) — in `/boot` for installed systems, `/live` for ISOs
|
|
- EFI binaries (`*.efi`) — grubx64, shimx64, mmx64, fbx64
|
|
|
|
GRUB `.mod` modules are not PE binaries and are not individually signed (GRUB
|
|
has its own module-signature mechanism, out of scope here). If you use the
|
|
shim-provided fallback loader, the Microsoft-signed shim validates grubx64.efi
|
|
against your MOK.
|
|
|
|
## Notes
|
|
|
|
- Requires `sbsigntool` on the build host. `mokutil` (for enrollment) is
|
|
installed in the image as part of the EFI boot flavour:
|
|
`BOOT=efi make iso-server` (the `efi` flavour adds `grub-efi-amd64
|
|
shim-signed mokutil`).
|
|
- Losing `MOK.priv` means you cannot sign future updates — back it up.
|
|
- Full vendor CA / Microsoft KEK signing is intentionally not used; revisit
|
|
only if a commercial distribution is ever pursued.
|